Fix NTE_PERM (0X80090010) Access Denied Error

Cause #1: Corrupted Windows Hello PIN

This is the most common reason you're seeing 0X80090010. The PIN stored in the TPM (Trusted Platform Module) got scrambled — usually after a Windows update or a failed login attempt. I've seen this happen on Dell XPS 13s and Lenovo ThinkPads after applying the KB5012599 update.

Here's how to fix it:

1. Press Windows Key + I to open Settings.
2. Go to Accounts > Sign-in options.
3. Under Windows Hello PIN, click Remove. Yes, it'll ask you to verify your Microsoft account password. That's fine.
4. Restart your PC — don't skip this.
5. Go back to the same spot and click Set up your PIN. Create a new one.

This clears the corrupted data and rebuilds it fresh. I've fixed dozens of machines this way. If the Remove button is grayed out, move to the next fix.

Cause #2: TPM Driver or Firmware Problems

If removing the PIN didn't work — or the button was locked — the TPM itself might have a bad driver or outdated firmware. This shows up on HP EliteBooks and Surface Pro 7s more often than others.

First, update the TPM driver:

1. Press Windows Key + X and select Device Manager.
2. Expand Security devices.
3. Right-click Trusted Platform Module 2.0 and choose Update driver > Search automatically.

If Windows doesn't find a newer driver, check your PC manufacturer's site for a TPM firmware update. On newer systems, you can also try clearing the TPM in Windows:

1. Press Windows Key + R, type tpm.msc, and hit Enter.
2. In the TPM Management window, click Clear TPM on the right panel.
3. Restart your PC. You'll need to go through the setup prompts on reboot — it's normal.

Warning: Clearing the TPM wipes all PINs and biometric data. Your files and apps stay untouched. I do this as a last resort because it's a bit nuclear, but it works.

Cause #3: NTFS Permissions on the Credential Keys Folder

This one's less common but sneaky. The folder where Windows stores your cryptographic keys can lose proper permissions — especially if you've messed with user accounts or run malware removal tools. The error pops up when apps like Outlook or Chrome try to access those keys.

To check permissions:

1. Open File Explorer and go to C:\ProgramData\Microsoft\Crypto\RSA.
2. Right-click the MachineKeys folder and select Properties > Security.
3. Click Advanced. Make sure SYSTEM and Administrators have Full Control. Your user account should have Modify at least.
4. If anything's missing, click Change permissions, add the proper entries, and check Replace all child object permissions.

Apply and restart. I've seen this fix the error on systems where someone ran a third-party registry cleaner.

Quick-Reference Summary Table

That's it. Try the PIN fix first — that's the real fix 80% of the time. If you're still stuck after these steps, you might have a failing TPM chip. But I'd bet your PC will be fine after step one.